Certificate decoder (runs in your browser)
Paste a certificate and read what is inside it: subject, issuer, validity dates, every hostname it covers, key algorithm and size, serial, and SHA-256 fingerprint. This certificate decoder parses the PEM locally in your browser — the certificate is never sent to us or anyone else.
What the check covers
Decoded locally, not uploaded
Most online decoders post your certificate to their server. This one ships the parser to your browser instead, so the PEM you paste stays on your machine. Certificates are public by design, but the habit of pasting them into other people’s servers is worth breaking — one day the clipboard holds the key file.
The fields that answer real questions
Who issued it, when it expires and how many days are left, which hostnames the SAN list actually covers, whether it is a CA certificate, and the exact key type and size. The fields renewals break are the fields shown first.
Whole chains, in order
Paste a fullchain.pem and every certificate in it is decoded separately — leaf, intermediates, root — so you can see which link expires first and who signs whom.
PEM or bare base64
Standard PEM blocks work with any surrounding text, and so does a bare base64 DER blob copied out of a config file or a Kubernetes secret.
Common questions
Is it safe to paste a certificate here?
The certificate is parsed by JavaScript running in your browser and is not transmitted anywhere — you can verify with your browser’s network tab. Never paste private keys into any website, including this one; the decoder refuses them and says so.
What formats does the certificate decoder accept?
PEM (the -----BEGIN CERTIFICATE----- format), several PEM blocks concatenated as a bundle, a bare base64-encoded DER certificate, or base64-wrapped PEM as found in a Kubernetes tls.crt. Binary .der files need base64-encoding first: run base64 on the file and paste the output.
Can it decode a CSR or a private key?
No. It decodes X.509 certificates only. A pasted private key is rejected with a warning rather than parsed, because private keys should never be pasted into a browser at all.
Why decode a certificate instead of checking the live site?
Decoding answers questions about a file you hold: the renewal your CA just emailed you, the certificate in a config bundle, the one a colleague sent over. To see what a server actually serves visitors, use the SSL checker instead — the two disagree more often than you would hope.